what is this attack type?

DOS

DDOS

hardware issue

software issue

Hello all,
I have a dell server about 9 month:
xeon x3220
cpanel
mysql
centos
apache
php 5.2.16
csf
all these softs are updated.
About 500 accounts are located on it and about 6 to 10 accounts are active. I can say other accounts have no visit really.
Csf connection limit is 80 and 10 to 20 IPs are blocking per day for 15 mins for "to many connections".80% of IPs are from foreign countries (that there is no visit from them) and they are from different locations.

Recently my server is going down once at 24 to 72 hrs.

At that time:
my sql has more than 150 queries in the queue.
Server load is going up to 200 or even more.
Csf send many emails at same time. (Excessive processes running under user..)
all mails are at same time and alert for different users.
I also installed PRM (process resource monitor) to limit cpu and ram usage.
Prm also send many emails at that time with content like this:
EVENT: HARD FAIL MAX_PROC
use:135/max:30
ACTION: KILL_PARENT SET; KILLED
PARENT/CHILDREN PROCS WITH 'kill
-9 27192 '
PPID: 27192
PID: 3065
USER: ...
CPU: 0% (max 15)
MEM: 0% (max 8)
ETIME: 0108 (max )
PROCS: 138 (max 30)
CMD: /usr/bin/php /home/
.../public_html/
filename.php

PRM mails are also for different users at same time and all accounts have approximately equal PROCS value (about 130 to 200).

You might want to change CSF from temp ban to perm ban. And, check that account a lot closer for issues. If this is all one account, suspend it to protect your server and then inspect it with a fine tooth comb.

Stop hovering to collapse...Click to collapse...Hover to expand...Click to expand...

After installing it and starting it up, it will log to ~/system-snapshot for log files every minute for 60 minutes. When the server crashes, it will quit logging, so the last log will be the one right before the crash.

Of note, you haven't yet provided any information from /var/log/messages on the time it crashed. It's impossible to know if there's a system hardware or OS-level issue if you haven't viewed /var/log/messages